Copied from https://github.com/ansemjo/tinyssh-convert/blob/9028c16d99c6ab36aa3e51ac4f3c0b505ebfdff5/utilities.h
--- compat/recallocarray.c
+++ compat/recallocarray.c
@@ -73,8 +73,11 @@ recallocarray(void *ptr, size_t oldnmemb, size_t newnmemb, size_t size)
 	} else
 		memcpy(newptr, ptr, newsize);
 
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
+
 #ifdef __APPLE__
-	memset_s(ptr, oldsize, 0, oldsize);
+	memzero(ptr, oldsize);
 #elif defined(__NetBSD__)
 	explicit_memset(ptr, oldsize, 0);
 #else
--- compat/siphash.c
+++ compat/siphash.c
@@ -132,8 +132,11 @@ SipHash_End(SIPHASH_CTX *ctx, int rc, int rf)
 
 	r = (ctx->v[0] ^ ctx->v[1]) ^ (ctx->v[2] ^ ctx->v[3]);
 
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
+
 #ifdef __APPLE__
-	memset_s(ctx, sizeof(*ctx), 0, sizeof(*ctx));
+	memzero(ctx, sizeof(*ctx));
 #elif defined(__NetBSD__)
 	explicit_memset(ctx, sizeof(*ctx), 0);
 #else
--- gotwebd/auth.c
+++ gotwebd/auth.c
@@ -383,8 +383,12 @@
 	    " SameSite=Strict;%s Path=/; HttpOnly; Max-Age=%llu\r\n", token,
 	    env->auth_config == GOTWEBD_AUTH_SECURE ? " Secure;" : "",
 	    validity);
+
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
+
 #ifdef __APPLE__
-	memset_s(token, sizeof(*token), 0, sizeof(*token));
+	memzero(token, sizeof(*token));
 #elif defined(__NetBSD__)
 	explicit_memset(token, sizeof(*token), 0);
 #else 
--- gotwebd/gotwebd.c
+++ gotwebd/gotwebd.c
@@ -1021,8 +1021,11 @@
 	    secret, sizeof(secret)) == -1)
 		fatal("main_compose_auth GOTWEB_IMSG_AUTH_SECRET");
 
+void * (* const volatile volatile_memset)(void *, int, size_t) = memset;
+#define memzero(ptr, size) volatile_memset(ptr, 0, size)
+
 #ifdef __APPLE__
-	memset_s(secret, sizeof(*secret), 0, sizeof(*secret));
+	memzero(secret, sizeof(*secret));
 #elif defined(__NetBSD__)
 	explicit_memset(secret, sizeof(*secret), 0);
 #else